@hookflo/tern 4.0.3 → 4.1.0

package/dist/adapters/express.d.ts

@@ -16,5 +16,6 @@ export interface ExpressWebhookMiddlewareOptions {
     normalize?: boolean | NormalizeOptions;
     queue?: QueueOption;
     onError?: (error: Error) => void;
+    strictRawBody?: boolean;
 }
 export declare function createWebhookMiddleware(options: ExpressWebhookMiddlewareOptions): (req: ExpressLikeRequest, res: ExpressLikeResponse, next: ExpressLikeNext) => Promise<void>;

package/dist/adapters/express.js

@@ -7,6 +7,15 @@ const shared_1 = require("./shared");
 function createWebhookMiddleware(options) {
     return async (req, res, next) => {
         try {
+            const strictRawBody = options.strictRawBody ?? true;
+            if (strictRawBody && (0, shared_1.hasParsedBody)(req)) {
+                res.status(400).json({
+                    error: 'Webhook request body must be raw bytes. Configure express.raw({ type: "*/*" }) before this middleware.',
+                    errorCode: 'VERIFICATION_ERROR',
+                    platform: options.platform,
+                });
+                return;
+            }
             const webRequest = await (0, shared_1.toWebRequest)(req);
             if (options.queue) {
                 const queueConfig = (0, queue_1.resolveQueueConfig)(options.queue);
@@ -17,7 +26,7 @@ function createWebhookMiddleware(options) {
                     toleranceInSeconds: options.toleranceInSeconds ?? 300,
                 });
                 const bodyText = await queueResponse.text();
-                let body = undefined;
+                let body;
                 if (bodyText) {
                     try {
                         body = JSON.parse(bodyText);

package/dist/adapters/shared.d.ts

@@ -8,6 +8,7 @@ export interface MinimalNodeRequest {
     url?: string;
     on?: (event: string, cb: (chunk?: unknown) => void) => void;
 }
+export declare function hasParsedBody(request: MinimalNodeRequest): boolean;
 export declare function extractRawBody(request: MinimalNodeRequest): Promise<Uint8Array>;
 export declare function toHeadersInit(headers: Record<string, string | string[] | undefined>): HeadersInit;
 export declare function toWebRequest(request: MinimalNodeRequest): Promise<Request>;

package/dist/adapters/shared.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasParsedBody = hasParsedBody;
 exports.extractRawBody = extractRawBody;
 exports.toHeadersInit = toHeadersInit;
 exports.toWebRequest = toWebRequest;
@@ -10,6 +11,14 @@ function getHeaderValue(headers, name) {
     }
     return value;
 }
+function hasParsedBody(request) {
+    const { body } = request;
+    return body !== null
+        && body !== undefined
+        && typeof body === 'object'
+        && !(body instanceof Uint8Array)
+        && !(body instanceof ArrayBuffer);
+}
 async function readIncomingMessageBodyAsBuffer(request) {
     if (!request.on)
         return new Uint8Array(0);
@@ -52,7 +61,7 @@ async function extractRawBody(request) {
     if (typeof body === 'string') {
         return new TextEncoder().encode(body);
     }
-    if (body !== null && body !== undefined && typeof body === 'object') {
+    if (hasParsedBody(request)) {
         console.warn('[Tern] Warning: request body is already parsed as JSON. '
             + 'Signature verification may fail. '
             + 'Add express.raw({ type: "*/*" }) before Tern on webhook routes, '

package/dist/index.d.ts

@@ -8,6 +8,7 @@ export declare class WebhookVerificationService {
     static verifyWithPlatformConfig<TPayload = unknown>(request: Request, platform: WebhookPlatform, secret: string, toleranceInSeconds?: number, normalize?: boolean | NormalizeOptions): Promise<WebhookVerificationResult<TPayload>>;
     static verifyAny<TPayload = unknown>(request: Request, secrets: MultiPlatformSecrets, toleranceInSeconds?: number, normalize?: boolean | NormalizeOptions): Promise<WebhookVerificationResult<TPayload>>;
     private static resolveCanonicalEventId;
+    private static safeCompare;
     private static pickString;
     private static resolveRawEventId;
     static detectPlatform(request: Request): WebhookPlatform;

package/dist/index.js

@@ -37,6 +37,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getPlatformsByCategory = exports.getPlatformNormalizationCategory = exports.normalizePayload = exports.createCustomVerifier = exports.createAlgorithmVerifier = exports.validateSignatureConfig = exports.getPlatformsUsingAlgorithm = exports.platformUsesAlgorithm = exports.getPlatformAlgorithmConfig = exports.WebhookVerificationService = void 0;
+const crypto_1 = require("crypto");
 const algorithms_1 = require("./verifiers/algorithms");
 const custom_algorithms_1 = require("./verifiers/custom-algorithms");
 const algorithms_2 = require("./platforms/algorithms");
@@ -103,18 +104,25 @@ class WebhookVerificationService {
             return this.verifyWithPlatformConfig(requestClone, detectedPlatform, secrets[detectedPlatform], toleranceInSeconds, normalize);
         }
         const failedAttempts = [];
-        for (const [platform, secret] of Object.entries(secrets)) {
-            if (!secret) {
-                continue;
-            }
-            const result = await this.verifyWithPlatformConfig(requestClone, platform.toLowerCase(), secret, toleranceInSeconds, normalize);
-            if (result.isValid) {
-                return result;
-            }
+        const verificationResults = await Promise.all(Object.entries(secrets)
+            .filter(([, secret]) => Boolean(secret))
+            .map(async ([platform, secret]) => {
+            const normalizedPlatform = platform.toLowerCase();
+            const result = await this.verifyWithPlatformConfig(requestClone, normalizedPlatform, secret, toleranceInSeconds, normalize);
+            return {
+                platform: normalizedPlatform,
+                result,
+            };
+        }));
+        const firstValid = verificationResults.find((item) => item.result.isValid);
+        if (firstValid) {
+            return firstValid.result;
+        }
+        for (const item of verificationResults) {
             failedAttempts.push({
-                platform: platform.toLowerCase(),
-                error: result.error,
-                errorCode: result.errorCode,
+                platform: item.platform,
+                error: item.result.error,
+                errorCode: item.result.errorCode,
             });
         }
         const details = failedAttempts
@@ -138,6 +146,12 @@ class WebhookVerificationService {
             return null;
         return `${platform}_${rawId}`;
     }
+    static safeCompare(a, b) {
+        if (a.length !== b.length) {
+            return false;
+        }
+        return (0, crypto_1.timingSafeEqual)(new TextEncoder().encode(a), new TextEncoder().encode(b));
+    }
     static pickString(...candidates) {
         for (const candidate of candidates) {
             if (candidate === undefined || candidate === null) {
@@ -178,7 +192,7 @@ class WebhookVerificationService {
             case 'doppler':
                 return this.pickString(payload?.event?.id, metadata?.id) || null;
             case 'sanity':
-                return this.pickString(payload?.transactionId, payload?._id) || null;
+                return this.pickString(payload?.transactionId, payload?.['_id']) || null;
             case 'razorpay':
                 return this.pickString(payload?.payload?.payment?.entity?.id, payload?.payload?.order?.entity?.id, payload?.payload?.subscription?.entity?.id) || null;
             case 'lemonsqueezy': {
@@ -199,7 +213,7 @@ class WebhookVerificationService {
         }
     }
     static detectPlatform(request) {
-        const headers = request.headers;
+        const { headers } = request;
         if (headers.has('stripe-signature'))
             return 'stripe';
         if (headers.has('x-hub-signature-256'))
@@ -269,8 +283,8 @@ class WebhookVerificationService {
                     platform: 'custom',
                 };
             }
-            // Simple comparison - we don't actually verify, just check if tokens match
-            const isValid = idHeader === webhookId && tokenHeader === webhookToken;
+            const isValid = this.safeCompare(idHeader, webhookId)
+                && this.safeCompare(tokenHeader, webhookToken);
             if (!isValid) {
                 return {
                     isValid: false,
@@ -291,7 +305,7 @@ class WebhookVerificationService {
                 isValid: true,
                 platform: 'custom',
                 payload: payload,
-                eventId: `custom:${idHeader}`,
+                eventId: `custom_${idHeader}`,
                 metadata: {
                     id: idHeader,
                     algorithm: 'token-based',

package/dist/upstash/queue.js

@@ -39,16 +39,12 @@ exports.handleProcess = handleProcess;
 exports.handleQueuedRequest = handleQueuedRequest;
 const QStash = __importStar(require("@upstash/qstash"));
 const index_1 = require("../index");
-async function dynamicImport(modulePath) {
-    return new Function('modulePath', 'return import(modulePath);')(modulePath);
-}
 async function loadQStashModules() {
     const optionalImports = await Promise.allSettled([
-        dynamicImport('@upstash/qstash'),
-        dynamicImport('@upstash/qstash/nextjs'),
-        dynamicImport('@upstash/qstash/nuxt'),
-        dynamicImport('@upstash/qstash/sveltekit'),
-        dynamicImport('@upstash/qstash/cloudflare'),
+        Promise.resolve().then(() => __importStar(require('@upstash/qstash'))),
+        Promise.resolve().then(() => __importStar(require('@upstash/qstash/nextjs'))),
+        Promise.resolve().then(() => __importStar(require('@upstash/qstash/nuxt'))),
+        Promise.resolve().then(() => __importStar(require('@upstash/qstash/cloudflare'))),
     ]);
     return [
         QStash,
@@ -92,25 +88,24 @@ function resolveNestedConstructor(modules, key) {
 }
 async function createQStashReceiver(queueConfig) {
     const modules = await loadQStashModules();
-    const receiverExport = resolveModuleExport(modules, 'Receiver')
+    const ReceiverCtor = resolveModuleExport(modules, 'Receiver')
         ?? resolveNestedConstructor(modules, 'Receiver');
-    if (typeof receiverExport !== 'function') {
+    if (typeof ReceiverCtor !== 'function') {
         throw new Error('[tern] Incompatible @upstash/qstash version: Receiver export not found. Ensure @upstash/qstash is installed and up-to-date.');
     }
-    return new receiverExport({
+    return new ReceiverCtor({
         currentSigningKey: queueConfig.signingKey,
         nextSigningKey: queueConfig.nextSigningKey,
     });
 }
 async function createQStashClient(queueConfig) {
     const modules = await loadQStashModules();
-    const clientExport = resolveModuleExport(modules, 'Client');
-    const resolvedClientExport = clientExport
+    const ClientCtor = resolveModuleExport(modules, 'Client')
         ?? resolveNestedConstructor(modules, 'Client');
-    if (typeof resolvedClientExport !== 'function') {
+    if (typeof ClientCtor !== 'function') {
         throw new Error('[tern] Incompatible @upstash/qstash version: Client export not found. Ensure @upstash/qstash is installed and up-to-date.');
     }
-    return new resolvedClientExport({ token: queueConfig.token });
+    return new ClientCtor({ token: queueConfig.token });
 }
 function nonRetryableResponse(message, status = 489) {
     return new Response(JSON.stringify({ error: message }), {
@@ -147,7 +142,7 @@ function toStableJson(value) {
 }
 async function resolveDeduplicationId(request, verificationResult) {
     const payload = verificationResult.payload;
-    const headers = request.headers;
+    const { headers } = request;
     const payloadId = typeof payload?.id === 'string' ? payload.id : null;
     const payloadRequestId = typeof payload?.request_id === 'string' ? payload.request_id : null;
     const nestedPayloadId = payload?.data && typeof payload.data === 'object' && typeof payload.data.id === 'string'

package/dist/verifiers/algorithms.d.ts

@@ -9,6 +9,7 @@ export declare abstract class AlgorithmBasedVerifier extends WebhookVerifier {
     protected extractSignatures(request: Request): string[];
     protected extractTimestamp(request: Request): number | null;
     protected extractTimestampFromSignature(request: Request): number | null;
+    protected requiresTimestamp(): boolean;
     protected formatPayload(rawBody: string, request: Request): string;
     protected formatCustomPayload(rawBody: string, request: Request): string;
     protected verifyHMAC(payload: string, signature: string, algorithm?: string): boolean;

package/dist/verifiers/algorithms.js

@@ -102,6 +102,29 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
         const timestampKey = this.config.customConfig?.timestampKey || "t";
         return sigMap[timestampKey] ? parseInt(sigMap[timestampKey], 10) : null;
     }
+    requiresTimestamp() {
+        // fal.ai timestamp is part of the signed payload itself — always required
+        if (this.platform === 'falai')
+            return true;
+        // These platforms have timestampHeader in config but timestamp
+        // is optional in their spec — validate only if present, never mandate
+        const optionalTimestampPlatforms = ['vercel', 'sentry', 'grafana'];
+        if (optionalTimestampPlatforms.includes(this.platform))
+            return false;
+        // For all other platforms: infer from config
+        if (this.config.timestampHeader)
+            return true;
+        if (this.config.payloadFormat === 'timestamped')
+            return true;
+        if (this.config.payloadFormat === 'custom'
+            && this.config.customConfig?.payloadFormat
+            && `${this.config.customConfig.payloadFormat}`.includes('{timestamp}'))
+            return true;
+        if (this.config.headerFormat === 'comma-separated'
+            && this.config.customConfig?.timestampKey)
+            return true;
+        return false;
+    }
     formatPayload(rawBody, request) {
         switch (this.config.payloadFormat) {
             case "timestamped": {
@@ -273,6 +296,14 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
             else {
                 timestamp = this.extractTimestamp(request);
             }
+            if (this.requiresTimestamp() && !timestamp) {
+                return {
+                    isValid: false,
+                    error: 'Missing required timestamp for webhook verification',
+                    errorCode: 'MISSING_SIGNATURE',
+                    platform: this.platform,
+                };
+            }
             if (timestamp && !this.isTimestampValid(timestamp)) {
                 return {
                     isValid: false,
@@ -357,7 +388,15 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
         if (cached && Date.now() < cached.expiresAt) {
             return cached.pems;
         }
-        const response = await fetch(jwksUrl);
+        const abortController = new AbortController();
+        const timeout = setTimeout(() => abortController.abort(), 3000);
+        let response;
+        try {
+            response = await fetch(jwksUrl, { signal: abortController.signal });
+        }
+        finally {
+            clearTimeout(timeout);
+        }
         if (!response.ok) {
             throw new Error(`Failed to fetch JWKS from ${jwksUrl}: ${response.status}`);
         }
@@ -396,7 +435,7 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
      *   2. Non-empty secret passed directly (user-provided PEM)
      *   3. JWKS URL in config (fal.ai — fetches all keys, tries each)
      */
-    async resolvePublicKeys(request) {
+    async resolvePublicKeys() {
         // 1. explicit public key in config
         const configPublicKey = this.config.customConfig?.publicKey;
         if (configPublicKey) {
@@ -449,16 +488,22 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
                 const timestampHeader = this.config.customConfig?.timestampHeader ||
                     "x-fal-webhook-timestamp";
                 const timestampStr = request.headers.get(timestampHeader);
-                if (timestampStr) {
-                    const timestamp = parseInt(timestampStr, 10);
-                    if (!this.isTimestampValid(timestamp)) {
-                        return {
-                            isValid: false,
-                            error: "Webhook timestamp expired",
-                            errorCode: "TIMESTAMP_EXPIRED",
-                            platform: this.platform,
-                        };
-                    }
+                if (!timestampStr) {
+                    return {
+                        isValid: false,
+                        error: 'Missing required timestamp for webhook verification',
+                        errorCode: 'MISSING_SIGNATURE',
+                        platform: this.platform,
+                    };
+                }
+                const timestamp = parseInt(timestampStr, 10);
+                if (!this.isTimestampValid(timestamp)) {
+                    return {
+                        isValid: false,
+                        error: "Webhook timestamp expired",
+                        errorCode: "TIMESTAMP_EXPIRED",
+                        platform: this.platform,
+                    };
                 }
             }
             const payload = this.platform === "falai"
@@ -467,7 +512,7 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
             // resolve all public keys
             let publicKeys;
             try {
-                publicKeys = await this.resolvePublicKeys(request);
+                publicKeys = await this.resolvePublicKeys();
             }
             catch (error) {
                 return {

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@hookflo/tern",
-  "version": "4.0.3",
+  "version": "4.1.0",
   "description": "A robust, scalable webhook verification framework supporting multiple platforms and signature algorithms",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",
-    "test": "node dist/test.js",
+    "test": "ts-node src/test.ts",
     "lint": "eslint src/**/*.ts",
     "lint:fix": "eslint 'src/**/*.ts' --fix",
     "format": "prettier --write src/**/*.ts",

package/dist/adapters/testExpress.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/adapters/testExpress.js

@@ -1,83 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const crypto_1 = __importDefault(require("crypto"));
-const shared_1 = require("./shared");
-const __1 = __importDefault(require(".."));
-const secret = 'whsec_test_secret';
-const payload = `${JSON.stringify({ type: 'payment_intent.succeeded', data: { amount: 2000 } })}\n`;
-function buildStripeSignature(body, secret) {
-    const timestamp = Math.floor(Date.now() / 1000);
-    const signed = `${timestamp}.${body}`;
-    const hmac = crypto_1.default
-        .createHmac('sha256', secret.replace('whsec_', ''))
-        .update(signed)
-        .digest('hex');
-    return `t=${timestamp},v1=${hmac}`;
-}
-// ── Test 1: raw stream — no middleware ran ───────────────────
-async function testRawStream() {
-    const sig = buildStripeSignature(payload, secret); // ✓ fixed: was missing secret arg
-    const chunks = [Buffer.from(payload, 'utf8')];
-    const req = {
-        method: 'POST',
-        headers: {
-            'stripe-signature': sig,
-            'content-type': 'application/json',
-        },
-        body: undefined,
-        on: (event, cb) => {
-            if (event === 'data') {
-                for (const chunk of chunks)
-                    cb(chunk);
-            }
-            if (event === 'end') {
-                cb();
-            }
-        },
-    };
-    const webReq = await (0, shared_1.toWebRequest)(req);
-    const result = await __1.default.verifyWithPlatformConfig(webReq, 'stripe', secret);
-    console.log('Test 1 Raw stream (no middleware):', result.isValid ? '✓ PASS' : `✗ FAIL — ${result.error}`);
-}
-// ── Test 2: Buffer body — express.raw() ran ──────────────────
-async function testBufferBody() {
-    const sig = buildStripeSignature(payload, secret);
-    const req = {
-        method: 'POST',
-        headers: {
-            'content-type': 'application/json',
-            'stripe-signature': sig,
-        },
-        body: Buffer.from(payload, 'utf8'),
-    };
-    const webReq = await (0, shared_1.toWebRequest)(req);
-    const result = await __1.default.verifyWithPlatformConfig(webReq, 'stripe', secret);
-    console.log('Test 2 Buffer body (express.raw):', result.isValid ? '✓ PASS' : `✗ FAIL — ${result.error}`);
-}
-// ── Test 3: parsed object — express.json() ran ───────────────
-async function testParsedObject() {
-    // signature computed against raw payload including \n
-    const sig = buildStripeSignature(payload, secret);
-    const req = {
-        method: 'POST',
-        headers: {
-            'content-type': 'application/json',
-            'stripe-signature': sig,
-        },
-        body: JSON.parse(payload), // \n gone, bytes lost
-    };
-    const webReq = await (0, shared_1.toWebRequest)(req);
-    const result = await __1.default.verifyWithPlatformConfig(webReq, 'stripe', secret);
-    // should FAIL — \n was in original signature but lost after JSON.parse
-    console.log('Test 3 Parsed object (express.json):', !result.isValid ? '✓ FAILS AS EXPECTED' : '✗ SHOULD HAVE FAILED');
-}
-async function run() {
-    await testRawStream(); // no middleware      → should PASS
-    await testBufferBody(); // express.raw()      → should PASS
-    await testParsedObject(); // express.json()     → should FAIL as expected
-    console.log('\nDone. Test 3 failing is correct behavior.');
-}
-run();

package/dist/test-compiled.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/test-compiled.js

@@ -1,4 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const test_1 = require("./test");
-(0, test_1.runTests)();

package/dist/test.d.ts

@@ -1,2 +0,0 @@
-declare function runTests(): Promise<void>;
-export { runTests };

package/dist/test.js

@@ -1,668 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runTests = runTests;
-const crypto_1 = require("crypto");
-const index_1 = require("./index");
-const testSecret = 'whsec_test_secret_key_12345';
-const testBody = JSON.stringify({ event: 'test', data: { id: '123' } });
-function createMockRequest(headers, body = testBody) {
-    return new Request('https://example.com/webhook', {
-        method: 'POST',
-        headers,
-        body,
-    });
-}
-function createStripeSignature(body, secret, timestamp) {
-    const signedPayload = `${timestamp}.${body}`;
-    const hmac = (0, crypto_1.createHmac)('sha256', secret);
-    hmac.update(signedPayload);
-    const signature = hmac.digest('hex');
-    return `t=${timestamp},v1=${signature}`;
-}
-function createGitHubSignature(body, secret) {
-    const hmac = (0, crypto_1.createHmac)('sha256', secret);
-    hmac.update(body);
-    return `sha256=${hmac.digest('hex')}`;
-}
-function createGitLabSignature(body, secret) {
-    // GitLab just compares the token in X-Gitlab-Token header
-    return secret;
-}
-function createClerkSignature(body, secret, id, timestamp) {
-    const signedContent = `${id}.${timestamp}.${body}`;
-    const secretBytes = new Uint8Array(Buffer.from(secret.split('_')[1], 'base64'));
-    const hmac = (0, crypto_1.createHmac)('sha256', secretBytes);
-    hmac.update(signedContent);
-    return `v1,${hmac.digest('base64')}`;
-}
-function createStandardWebhooksSignature(body, secret, id, timestamp) {
-    const signedContent = `${id}.${timestamp}.${body}`;
-    const base64Secret = secret.includes('_') ? secret.split('_')[1] : secret;
-    const secretBytes = new Uint8Array(Buffer.from(base64Secret, 'base64'));
-    const hmac = (0, crypto_1.createHmac)('sha256', secretBytes);
-    hmac.update(signedContent);
-    return `v1,${hmac.digest('base64')}`;
-}
-function createPaddleSignature(body, secret, timestamp) {
-    const signedPayload = `${timestamp}:${body}`;
-    const hmac = (0, crypto_1.createHmac)('sha256', secret);
-    hmac.update(signedPayload);
-    return `ts=${timestamp};h1=${hmac.digest('hex')}`;
-}
-function createShopifySignature(body, secret) {
-    const hmac = (0, crypto_1.createHmac)('sha256', secret);
-    hmac.update(body);
-    return hmac.digest('base64');
-}
-function createWooCommerceSignature(body, secret) {
-    const hmac = (0, crypto_1.createHmac)('sha256', secret);
-    hmac.update(body);
-    return hmac.digest('base64');
-}
-function createWorkOSSignature(body, secret, timestamp) {
-    const signedPayload = `${timestamp}.${body}`;
-    const hmac = (0, crypto_1.createHmac)('sha256', secret);
-    hmac.update(signedPayload);
-    return `t=${timestamp},v1=${hmac.digest('hex')}`;
-}
-function createSentrySignature(body, secret) {
-    const hmac = (0, crypto_1.createHmac)('sha256', secret);
-    hmac.update(JSON.stringify(JSON.parse(body)));
-    return hmac.digest('hex');
-}
-function createSentryIssueAlertSignature(issueAlertObject, secret) {
-    const hmac = (0, crypto_1.createHmac)('sha256', secret);
-    hmac.update(JSON.stringify(issueAlertObject));
-    return hmac.digest('hex');
-}
-function createGrafanaSignature(body, secret, timestamp) {
-    const payload = timestamp ? `${timestamp}.${body}` : body;
-    const hmac = (0, crypto_1.createHmac)('sha256', secret);
-    hmac.update(payload);
-    return hmac.digest('hex');
-}
-function createDopplerSignature(body, secret) {
-    const hmac = (0, crypto_1.createHmac)('sha256', secret);
-    hmac.update(body);
-    return `sha256=${hmac.digest('hex')}`;
-}
-function createSanitySignature(body, secret, timestamp) {
-    const hmac = (0, crypto_1.createHmac)('sha256', secret);
-    hmac.update(`${timestamp}.${body}`);
-    return `t=${timestamp},v1=${hmac.digest('hex')}`;
-}
-function createFalPayloadToSign(body, requestId, userId, timestamp) {
-    const bodyHash = (0, crypto_1.createHash)('sha256').update(body).digest('hex');
-    return `${requestId}\n${userId}\n${timestamp}\n${bodyHash}`;
-}
-async function runTests() {
-    console.log('🧪 Running Webhook Verification Tests...\n');
-    // Test 1: Stripe Webhook
-    console.log('1. Testing Stripe Webhook...');
-    try {
-        const timestamp = Math.floor(Date.now() / 1000);
-        const stripeSignature = createStripeSignature(testBody, testSecret, timestamp);
-        const stripeRequest = createMockRequest({
-            'stripe-signature': stripeSignature,
-            'content-type': 'application/json',
-        });
-        const stripeResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(stripeRequest, 'stripe', testSecret);
-        const stripePassed = stripeResult.isValid && Boolean(stripeResult.eventId?.startsWith('stripe:'));
-        console.log('   ✅ Stripe:', stripePassed ? 'PASSED' : 'FAILED');
-        if (!stripeResult.isValid) {
-            console.log('   ❌ Error:', stripeResult.error);
-        }
-    }
-    catch (error) {
-        console.log('   ❌ Stripe test failed:', error);
-    }
-    // Test 2: GitHub Webhook
-    console.log('\n2. Testing GitHub Webhook...');
-    try {
-        const githubSignature = createGitHubSignature(testBody, testSecret);
-        const githubRequest = createMockRequest({
-            'x-hub-signature-256': githubSignature,
-            'x-github-event': 'push',
-            'x-github-delivery': 'test-delivery-id',
-            'content-type': 'application/json',
-        });
-        const githubResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(githubRequest, 'github', testSecret);
-        console.log('   ✅ GitHub:', githubResult.isValid ? 'PASSED' : 'FAILED');
-        if (!githubResult.isValid) {
-            console.log('   ❌ Error:', githubResult.error);
-        }
-    }
-    catch (error) {
-        console.log('   ❌ GitHub test failed:', error);
-    }
-    // Test 3: Clerk Webhook
-    console.log('\n3. Testing Clerk Webhook...');
-    try {
-        // Create a proper Clerk-style secret (whsec_ + base64 encoded secret)
-        const base64Secret = Buffer.from(testSecret).toString('base64');
-        const clerkSecret = `whsec_${base64Secret}`;
-        const id = 'test-id-123';
-        const timestamp = Math.floor(Date.now() / 1000);
-        const clerkSignature = createClerkSignature(testBody, clerkSecret, id, timestamp);
-        const clerkRequest = createMockRequest({
-            'svix-signature': clerkSignature,
-            'svix-id': id,
-            'svix-timestamp': timestamp.toString(),
-            'content-type': 'application/json',
-        });
-        const clerkResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(clerkRequest, 'clerk', clerkSecret);
-        console.log('   ✅ Clerk:', clerkResult.isValid ? 'PASSED' : 'FAILED');
-        if (!clerkResult.isValid) {
-            console.log('   ❌ Error:', clerkResult.error);
-        }
-    }
-    catch (error) {
-        console.log('   ❌ Clerk test failed:', error);
-    }
-    // Test 4: Standard HMAC-SHA256 (Generic)
-    console.log('\n4. Testing Standard HMAC-SHA256...');
-    try {
-        const hmac = (0, crypto_1.createHmac)('sha256', testSecret);
-        hmac.update(testBody);
-        const signature = hmac.digest('hex');
-        const genericRequest = createMockRequest({
-            'x-webhook-signature': signature,
-            'content-type': 'application/json',
-        });
-        const genericResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(genericRequest, 'unknown', testSecret);
-        console.log('   ✅ Generic HMAC-SHA256:', genericResult.isValid ? 'PASSED' : 'FAILED');
-        if (!genericResult.isValid) {
-            console.log('   ❌ Error:', genericResult.error);
-        }
-    }
-    catch (error) {
-        console.log('   ❌ Generic test failed:', error);
-    }
-    // Test 4.5: Dodo Payments (Standard Webhooks / svix-style)
-    console.log('\n4.5. Testing Dodo Payments...');
-    try {
-        const webhookId = 'test-webhook-id-123';
-        const timestamp = Math.floor(Date.now() / 1000);
-        // Create a proper secret format for Standard Webhooks (whsec_ + base64 encoded secret)
-        const base64Secret = Buffer.from(testSecret).toString('base64');
-        const dodoSecret = `whsec_${base64Secret}`;
-        // Create svix-style signature: {webhook-id}.{webhook-timestamp}.{payload}
-        const signedContent = `${webhookId}.${timestamp}.${testBody}`;
-        // Use the base64-decoded secret for HMAC (like the Standard Webhooks library)
-        const secretBytes = new Uint8Array(Buffer.from(base64Secret, 'base64'));
-        const hmac = (0, crypto_1.createHmac)('sha256', secretBytes);
-        hmac.update(signedContent);
-        const signature = `v1,${hmac.digest('base64')}`;
-        const dodoRequest = createMockRequest({
-            'webhook-signature': signature,
-            'webhook-id': webhookId,
-            'webhook-timestamp': timestamp.toString(),
-            'content-type': 'application/json',
-        });
-        const dodoResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(dodoRequest, 'dodopayments', dodoSecret);
-        console.log('   ✅ Dodo Payments:', dodoResult.isValid ? 'PASSED' : 'FAILED');
-        if (!dodoResult.isValid) {
-            console.log('   ❌ Error:', dodoResult.error);
-        }
-    }
-    catch (error) {
-        console.log('   ❌ Dodo Payments test failed:', error);
-    }
-    // Test 5: Token-based authentication helper
-    console.log('\n5. Testing Token-based Authentication...');
-    try {
-        const webhookId = 'test-webhook-id';
-        const webhookToken = 'test-webhook-token';
-        const tokenRequest = createMockRequest({
-            'x-webhook-id': webhookId,
-            'x-webhook-token': webhookToken,
-            'content-type': 'application/json',
-        });
-        const tokenResult = await index_1.WebhookVerificationService.verifyTokenAuth(tokenRequest.clone(), webhookId, webhookToken);
-        const tokenAliasResult = await index_1.WebhookVerificationService.verifyTokenBased(tokenRequest.clone(), webhookId, webhookToken);
-        const tokenPassed = tokenResult.isValid && tokenAliasResult.isValid;
-        console.log('   ✅ Token-based:', tokenPassed ? 'PASSED' : 'FAILED');
-        if (!tokenResult.isValid) {
-            console.log('   ❌ Error:', tokenResult.error);
-        }
-    }
-    catch (error) {
-        console.log('   ❌ Token-based test failed:', error);
-    }
-    // Test 5.5: Sentry webhook verification (standard + issue alert fallback)
-    console.log('\n5.5. Testing Sentry Webhook...');
-    try {
-        const timestamp = Math.floor(Date.now() / 1000);
-        const requestId = 'sentry-request-id-123';
-        const sentryBody = JSON.stringify({
-            action: 'triggered',
-            data: {
-                issue_alert: {
-                    id: 'alert-1',
-                    title: 'CPU high',
-                    project: 'infra',
-                },
-            },
-        });
-        const sentryRequest = createMockRequest({
-            'sentry-hook-signature': createSentrySignature(sentryBody, testSecret),
-            'sentry-hook-timestamp': timestamp.toString(),
-            'request-id': requestId,
-            'content-type': 'application/json',
-        }, sentryBody);
-        const sentryResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(sentryRequest, 'sentry', testSecret);
-        const sentryIssueAlertRequest = createMockRequest({
-            'sentry-hook-signature': createSentryIssueAlertSignature({ id: 'alert-1', title: 'CPU high', project: 'infra' }, testSecret),
-            'sentry-hook-timestamp': timestamp.toString(),
-            'request-id': `${requestId}-issue-alert`,
-            'content-type': 'application/json',
-        }, sentryBody);
-        const sentryIssueAlertResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(sentryIssueAlertRequest, 'sentry', testSecret);
-        const sentryPassed = sentryResult.isValid && sentryIssueAlertResult.isValid && sentryResult.eventId?.startsWith('sentry:');
-        console.log('   ✅ Sentry:', sentryPassed ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ Sentry test failed:', error);
-    }
-    // Test 5.6: Grafana webhook verification
-    console.log('\n5.6. Testing Grafana Webhook...');
-    try {
-        const timestamp = Math.floor(Date.now() / 1000);
-        const grafanaSignature = createGrafanaSignature(testBody, testSecret, timestamp);
-        const grafanaRequest = createMockRequest({
-            'x-grafana-alerting-signature': grafanaSignature,
-            'x-grafana-alerting-timestamp': timestamp.toString(),
-            'content-type': 'application/json',
-        });
-        const grafanaResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(grafanaRequest, 'grafana', testSecret);
-        console.log('   ✅ Grafana:', grafanaResult.isValid ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ Grafana test failed:', error);
-    }
-    // Test 5.7: Doppler webhook verification
-    console.log('\n5.7. Testing Doppler Webhook...');
-    try {
-        const dopplerRequest = createMockRequest({
-            'x-doppler-signature': createDopplerSignature(testBody, testSecret),
-            'content-type': 'application/json',
-        });
-        const dopplerResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(dopplerRequest, 'doppler', testSecret);
-        const dopplerPassed = dopplerResult.isValid && Boolean(dopplerResult.eventId?.startsWith('doppler:'));
-        console.log('   ✅ Doppler:', dopplerPassed ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ Doppler test failed:', error);
-    }
-    // Test 5.8: Sanity webhook verification
-    console.log('\n5.8. Testing Sanity Webhook...');
-    try {
-        const timestamp = Math.floor(Date.now() / 1000);
-        const idempotencyKey = 'sanity-idem-123';
-        const sanityRequest = createMockRequest({
-            'sanity-webhook-signature': createSanitySignature(testBody, testSecret, timestamp),
-            'idempotency-key': idempotencyKey,
-            'content-type': 'application/json',
-        });
-        const sanityResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(sanityRequest, 'sanity', testSecret);
-        const sanityPassed = sanityResult.isValid && sanityResult.eventId === `sanity:${idempotencyKey}`;
-        console.log('   ✅ Sanity:', sanityPassed ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ Sanity test failed:', error);
-    }
-    // Test 6: Invalid signatures
-    console.log('\n6. Testing Invalid Signatures...');
-    try {
-        const invalidRequest = createMockRequest({
-            'stripe-signature': 't=1234567890,v1=invalid_signature',
-            'content-type': 'application/json',
-        });
-        const invalidResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(invalidRequest, 'stripe', testSecret);
-        const invalidSigPassed = !invalidResult.isValid && (invalidResult.errorCode === 'INVALID_SIGNATURE'
-            || invalidResult.errorCode === 'TIMESTAMP_EXPIRED');
-        console.log('   ✅ Invalid signature correctly rejected:', invalidSigPassed ? 'PASSED' : 'FAILED');
-        if (invalidResult.isValid) {
-            console.log('   ❌ Should have been rejected');
-        }
-    }
-    catch (error) {
-        console.log('   ❌ Invalid signature test failed:', error);
-    }
-    // Test 7: Missing headers
-    console.log('\n7. Testing Missing Headers...');
-    try {
-        const missingHeaderRequest = createMockRequest({
-            'content-type': 'application/json',
-        });
-        const missingHeaderResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(missingHeaderRequest, 'stripe', testSecret);
-        const missingHeaderPassed = !missingHeaderResult.isValid && missingHeaderResult.errorCode === 'MISSING_SIGNATURE';
-        console.log('   ✅ Missing headers correctly rejected:', missingHeaderPassed ? 'PASSED' : 'FAILED');
-        if (missingHeaderResult.isValid) {
-            console.log('   ❌ Should have been rejected');
-        }
-    }
-    catch (error) {
-        console.log('   ❌ Missing headers test failed:', error);
-    }
-    // Test 8: GitLab Webhook
-    console.log('\n8. Testing GitLab Webhook...');
-    try {
-        const gitlabSecret = testSecret;
-        const gitlabRequest = createMockRequest({
-            'X-Gitlab-Token': gitlabSecret,
-            'content-type': 'application/json',
-        });
-        const gitlabResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(gitlabRequest, 'gitlab', gitlabSecret);
-        console.log('   ✅ GitLab:', gitlabResult.isValid ? 'PASSED' : 'FAILED');
-        if (!gitlabResult.isValid) {
-            console.log('   ❌ Error:', gitlabResult.error);
-        }
-    }
-    catch (error) {
-        console.log('   ❌ GitLab test failed:', error);
-    }
-    // Test 9: GitLab Invalid Token
-    console.log('\n9. Testing GitLab Invalid Token...');
-    try {
-        const gitlabRequest = createMockRequest({
-            'X-Gitlab-Token': 'wrong_secret',
-            'content-type': 'application/json',
-        });
-        const gitlabResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(gitlabRequest, 'gitlab', testSecret);
-        console.log('   ✅ Invalid token correctly rejected:', !gitlabResult.isValid ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ GitLab invalid token test failed:', error);
-    }
-    // Test 10: verifyAny should auto-detect Stripe
-    console.log('\n10. Testing verifyAny auto-detection...');
-    try {
-        const timestamp = Math.floor(Date.now() / 1000);
-        const stripeSignature = createStripeSignature(testBody, testSecret, timestamp);
-        const request = createMockRequest({
-            'stripe-signature': stripeSignature,
-            'content-type': 'application/json',
-        });
-        const result = await index_1.WebhookVerificationService.verifyAny(request, {
-            stripe: testSecret,
-            github: 'wrong-secret',
-        });
-        console.log('   ✅ verifyAny:', result.isValid && result.platform === 'stripe' ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ verifyAny test failed:', error);
-    }
-    // Test 10.5: verifyAny error diagnostics
-    console.log('\n10.5. Testing verifyAny error diagnostics...');
-    try {
-        const unknownRequest = createMockRequest({
-            'content-type': 'application/json',
-        });
-        const invalidVerifyAny = await index_1.WebhookVerificationService.verifyAny(unknownRequest, {
-            stripe: testSecret,
-            shopify: testSecret,
-        });
-        const hasDetailedErrors = Boolean(invalidVerifyAny.error
-            && invalidVerifyAny.error.includes('Attempts ->')
-            && invalidVerifyAny.metadata?.attempts?.length === 2);
-        console.log('   ✅ verifyAny diagnostics:', hasDetailedErrors ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ verifyAny diagnostics test failed:', error);
-    }
-    // Test 11: Normalization for Stripe
-    console.log('\n11. Testing payload normalization...');
-    try {
-        const normalizedStripeBody = JSON.stringify({
-            type: 'payment_intent.succeeded',
-            data: {
-                object: {
-                    id: 'pi_123',
-                    amount: 5000,
-                    currency: 'usd',
-                    customer: 'cus_456',
-                },
-            },
-        });
-        const timestamp = Math.floor(Date.now() / 1000);
-        const stripeSignature = createStripeSignature(normalizedStripeBody, testSecret, timestamp);
-        const request = createMockRequest({
-            'stripe-signature': stripeSignature,
-            'content-type': 'application/json',
-        }, normalizedStripeBody);
-        const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, 'stripe', testSecret, 300, true);
-        const payload = result.payload;
-        const passed = result.isValid
-            && payload.event === 'payment.succeeded'
-            && payload.currency === 'USD'
-            && payload.transaction_id === 'pi_123';
-        console.log('   ✅ Normalization:', passed ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ Normalization test failed:', error);
-    }
-    // Test 12: Category-aware normalization registry
-    console.log('\n12. Testing category-based platform registry...');
-    try {
-        const paymentPlatforms = (0, index_1.getPlatformsByCategory)('payment');
-        const hasStripeAndPolar = paymentPlatforms.includes('stripe') && paymentPlatforms.includes('polar');
-        console.log('   ✅ Category registry:', hasStripeAndPolar ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ Category registry test failed:', error);
-    }
-    // Test 13: Razorpay
-    console.log('\n13. Testing Razorpay webhook...');
-    try {
-        const hmac = (0, crypto_1.createHmac)('sha256', testSecret);
-        hmac.update(testBody);
-        const signature = hmac.digest('hex');
-        const request = createMockRequest({
-            'x-razorpay-signature': signature,
-            'content-type': 'application/json',
-        });
-        const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, 'razorpay', testSecret);
-        console.log('   ✅ Razorpay:', result.isValid ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ Razorpay test failed:', error);
-    }
-    // Test 14: Lemon Squeezy
-    console.log('\n14. Testing Lemon Squeezy webhook...');
-    try {
-        const hmac = (0, crypto_1.createHmac)('sha256', testSecret);
-        hmac.update(testBody);
-        const signature = hmac.digest('hex');
-        const request = createMockRequest({
-            'x-signature': signature,
-            'content-type': 'application/json',
-        });
-        const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, 'lemonsqueezy', testSecret);
-        console.log('   ✅ Lemon Squeezy:', result.isValid ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ Lemon Squeezy test failed:', error);
-    }
-    // Test 15: Paddle
-    console.log('\n15. Testing Paddle webhook...');
-    try {
-        const timestamp = Math.floor(Date.now() / 1000);
-        const signature = createPaddleSignature(testBody, testSecret, timestamp);
-        const request = createMockRequest({
-            'paddle-signature': signature,
-            'content-type': 'application/json',
-        });
-        const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, 'paddle', testSecret);
-        console.log('   ✅ Paddle:', result.isValid ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ Paddle test failed:', error);
-    }
-    // Test 16: WorkOS
-    console.log('\n16. Testing WorkOS webhook...');
-    try {
-        const timestamp = Math.floor(Date.now() / 1000);
-        const signature = createWorkOSSignature(testBody, testSecret, timestamp);
-        const request = createMockRequest({
-            'workos-signature': signature,
-            'content-type': 'application/json',
-        });
-        const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, 'workos', testSecret);
-        console.log('   ✅ WorkOS:', result.isValid ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ WorkOS test failed:', error);
-    }
-    // Test 17.5: Shopify
-    console.log('\n17. Testing Shopify webhook...');
-    try {
-        const signature = createShopifySignature(testBody, testSecret);
-        const request = createMockRequest({
-            'x-shopify-hmac-sha256': signature,
-            'content-type': 'application/json',
-        });
-        const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, 'shopify', testSecret);
-        console.log('   ✅ Shopify:', result.isValid ? 'PASSED' : 'FAILED');
-        if (!result.isValid) {
-            console.log('   ❌ Error:', result.error);
-        }
-    }
-    catch (error) {
-        console.log('   ❌ Shopify test failed:', error);
-    }
-    // Test 18: WooCommerce
-    console.log('\n18. Testing WooCommerce webhook...');
-    try {
-        const signature = createWooCommerceSignature(testBody, testSecret);
-        const request = createMockRequest({
-            'x-wc-webhook-signature': signature,
-            'content-type': 'application/json',
-        });
-        const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, 'woocommerce', testSecret);
-        console.log('   ✅ WooCommerce:', result.isValid ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ WooCommerce test failed:', error);
-    }
-    // Test 18.5: Polar (Standard Webhooks)
-    console.log('\n18.5. Testing Polar webhook...');
-    try {
-        const secret = `whsec_${Buffer.from(testSecret).toString('base64')}`;
-        const webhookId = 'polar-webhook-id-1';
-        const timestamp = Math.floor(Date.now() / 1000);
-        const signature = createStandardWebhooksSignature(testBody, secret, webhookId, timestamp);
-        const request = createMockRequest({
-            'webhook-signature': signature,
-            'webhook-id': webhookId,
-            'webhook-timestamp': timestamp.toString(),
-            'user-agent': 'Polar.sh Webhooks',
-            'content-type': 'application/json',
-        });
-        const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, 'polar', secret);
-        const detectedPlatform = index_1.WebhookVerificationService.detectPlatform(request);
-        console.log('   ✅ Polar verification:', result.isValid ? 'PASSED' : 'FAILED');
-        console.log('   ✅ Polar auto-detect:', detectedPlatform === 'polar' ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ Polar test failed:', error);
-    }
-    // Test 19: Replicate
-    console.log('\n19. Testing Replicate webhook...');
-    try {
-        const secret = `whsec_${Buffer.from(testSecret).toString('base64')}`;
-        const webhookId = 'replicate-webhook-id-1';
-        const timestamp = Math.floor(Date.now() / 1000);
-        const signature = createStandardWebhooksSignature(testBody, secret, webhookId, timestamp);
-        const request = createMockRequest({
-            'webhook-signature': signature,
-            'webhook-id': webhookId,
-            'webhook-timestamp': timestamp.toString(),
-            'user-agent': 'Replicate-Webhooks/1.0',
-            'content-type': 'application/json',
-        });
-        const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, 'replicateai', secret);
-        console.log('   ✅ Replicate:', result.isValid ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ Replicate test failed:', error);
-    }
-    // Test 20: fal.ai
-    console.log('\n20. Testing fal.ai webhook...');
-    try {
-        const { privateKey, publicKey } = (0, crypto_1.generateKeyPairSync)('ed25519');
-        const requestId = 'fal-request-id';
-        const userId = 'fal-user-id';
-        const timestamp = Math.floor(Date.now() / 1000).toString();
-        const payloadToSign = createFalPayloadToSign(testBody, requestId, userId, timestamp);
-        const payloadBytes = new Uint8Array(Buffer.from(payloadToSign));
-        const signature = (0, crypto_1.sign)(null, payloadBytes, privateKey).toString('hex');
-        const request = createMockRequest({
-            'x-fal-webhook-signature': signature,
-            'x-fal-webhook-request-id': requestId,
-            'x-fal-webhook-user-id': userId,
-            'x-fal-webhook-timestamp': timestamp,
-            'content-type': 'application/json',
-        });
-        const result = await index_1.WebhookVerificationService.verify(request, {
-            platform: 'falai',
-            secret: '',
-            signatureConfig: {
-                algorithm: 'ed25519',
-                headerName: 'x-fal-webhook-signature',
-                headerFormat: 'raw',
-                payloadFormat: 'custom',
-                customConfig: {
-                    publicKey: publicKey.export({ type: 'spki', format: 'pem' }).toString(),
-                    requestIdHeader: 'x-fal-webhook-request-id',
-                    userIdHeader: 'x-fal-webhook-user-id',
-                    timestampHeader: 'x-fal-webhook-timestamp',
-                },
-            },
-        });
-        console.log('   ✅ fal.ai:', result.isValid ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ fal.ai test failed:', error);
-    }
-    // Test 21: Core SDK queue entry point
-    console.log('\n21. Testing core SDK handleWithQueue...');
-    try {
-        const request = createMockRequest({
-            'content-type': 'application/json',
-        });
-        const originalToken = process.env.QSTASH_TOKEN;
-        const originalCurrent = process.env.QSTASH_CURRENT_SIGNING_KEY;
-        const originalNext = process.env.QSTASH_NEXT_SIGNING_KEY;
-        delete process.env.QSTASH_TOKEN;
-        delete process.env.QSTASH_CURRENT_SIGNING_KEY;
-        delete process.env.QSTASH_NEXT_SIGNING_KEY;
-        let threw = false;
-        try {
-            await index_1.WebhookVerificationService.handleWithQueue(request, {
-                platform: 'stripe',
-                secret: testSecret,
-                queue: true,
-                handler: async () => undefined,
-            });
-        }
-        catch (error) {
-            threw = error.message.includes('queue: true requires QSTASH_TOKEN');
-        }
-        if (originalToken !== undefined)
-            process.env.QSTASH_TOKEN = originalToken;
-        if (originalCurrent !== undefined)
-            process.env.QSTASH_CURRENT_SIGNING_KEY = originalCurrent;
-        if (originalNext !== undefined)
-            process.env.QSTASH_NEXT_SIGNING_KEY = originalNext;
-        console.log('   ✅ handleWithQueue:', threw ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ handleWithQueue test failed:', error);
-    }
-    console.log('\n🎉 All tests completed!');
-}
-// Run tests if this file is executed directly
-if (require.main === module) {
-    runTests().catch(console.error);
-}